From 04ec4dadb7c15b62215dcce4100033da9e4bab00 Mon Sep 17 00:00:00 2001
From: Siddh2024 <siddh.sharma.247@gmail.com>
Date: Sun, 31 May 2026 13:01:46 +0530
Subject: [PATCH] fix(dashboard-api): enforce SameSite=Lax on all cookies to
 prevent CSRF attacks

Changes all dashboard-api cookies from SameSite=None (production) / Lax
(development) to SameSite=Lax across all environments. This prevents
the browser from sending cookies on cross-origin subresource requests,
closing the CSRF attack vector where an external site could trigger
authenticated API calls via cookie-bearing requests.

Affected cookies:
- accessToken (auth session)
- refreshToken (auth session)
- _csrf (CSRF secret cookie)
- dashboardGithubOauthState (GitHub OAuth state)

Closes #239
---
 apps/dashboard-api/src/app.js                      |  2 +-
 .../src/controllers/auth.controller.js             | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/apps/dashboard-api/src/app.js b/apps/dashboard-api/src/app.js
index 2e1b582e1..d7646c3f5 100644
--- a/apps/dashboard-api/src/app.js
+++ b/apps/dashboard-api/src/app.js
@@ -70,7 +70,7 @@ const csrfProtection = csurf({
     cookie: {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
-        sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+        sameSite: 'lax'
     } 
 });
 
diff --git a/apps/dashboard-api/src/controllers/auth.controller.js b/apps/dashboard-api/src/controllers/auth.controller.js
index 0bb10fedb..88e48d1b5 100644
--- a/apps/dashboard-api/src/controllers/auth.controller.js
+++ b/apps/dashboard-api/src/controllers/auth.controller.js
@@ -44,7 +44,7 @@ const getCookieOptions = () => {
         httpOnly: true,
         expires: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
         secure: process.env.NODE_ENV === 'production',
-        sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+        sameSite: 'lax'
     };
 
     if (process.env.NODE_ENV === 'production') {
@@ -83,7 +83,7 @@ const clearGithubStateCookie = (res) => {
     res.cookie(GITHUB_STATE_COOKIE, 'none', {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
-        sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
+        sameSite: 'lax',
         expires: new Date(Date.now() + 10 * 1000),
     });
 };
@@ -354,7 +354,7 @@ module.exports.startGithubAuth = async (req, res) => {
     res.cookie(GITHUB_STATE_COOKIE, state, {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
-        sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
+        sameSite: 'lax',
         expires: new Date(Date.now() + GITHUB_STATE_TTL_MS),
     });
 
@@ -565,13 +565,13 @@ module.exports.resetPassword = async (req, res) => {
                 expires: new Date(Date.now() + 10 * 1000),
                 httpOnly: true,
                 secure: process.env.NODE_ENV === 'production',
-                sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+                sameSite: 'lax'
             })
             .cookie('refreshToken', 'none', {
                 expires: new Date(Date.now() + 10 * 1000),
                 httpOnly: true,
                 secure: process.env.NODE_ENV === 'production',
-                sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+                sameSite: 'lax'
             })
             .json({ message: "Password reset successfully. Please log in with your new password." });
     } catch (err) {
@@ -597,13 +597,13 @@ module.exports.logout = async (req, res) => {
             expires: new Date(Date.now() + 10 * 1000),
             httpOnly: true,
             secure: process.env.NODE_ENV === 'production',
-            sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+            sameSite: 'lax'
         });
         res.cookie('refreshToken', 'none', {
             expires: new Date(Date.now() + 10 * 1000),
             httpOnly: true,
             secure: process.env.NODE_ENV === 'production',
-            sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax'
+            sameSite: 'lax'
         });
 
         res.status(200).json({ success: true, message: "Logged out successfully" });